The real issue here is that nothing else was encrypted which means this the hackers hackers have all the other information so if you use the same password for another service I would change that as well.
I love how you say this butSharedProphet said:Didn't help Shamus' brother [http://www.shamusyoung.com/twentysidedtale/?p=11467]...
is right at the bottom of that article. Don't get me wrong there is definitely a possibility and people should definitely be vigilante but I wonder how many claims are just happenstance as opposed to actual. Then again I only ever used store bought psn cards on my account if I have the choice that is the way I will always go and I do the same thing on XBL and anyother online places if possible. Otherwise wallmart prepaid cards are great.UPDATE: While the PSN notification about the breech arrived in the same morning as the news of my brother?s credit card theft, there are other factors in play here that point elsewhere. It?s impossible to say for sure, but let?s not lay the blame for this on Sony just yet.
Do you have a link to this I would love to read that. Cause that is web transaction 101 if they really did store them as plain text then they are definitely negligent in this aspect.PettingZOOPONY said:Just yesterday it was revealed by their own security experts the cards were kept in plain text. Wtf is going on.
I'll dig it up, people are already using the stolen info which indicates there was 0 encryption involved.midpipps said:Do you have a link to this I would love to read that. Cause that is web transaction 101 if they really did store them as plain text then they are definitely negligent in this aspect.PettingZOOPONY said:Just yesterday it was revealed by their own security experts the cards were kept in plain text. Wtf is going on.
Hmmm, you may have just relieved some worry from my own mind there, I dont think I've used my new card on PSN since getting it issued a few months ago. I only wish I could access the network to find out nowDanielBrown said:I'm glad I got my old, non-functioning credit card entered in my PSN.
Oh, that story again. Says nothing about how the PSN stored user information. The threat they're outlining is that someone could steal this information as it's being transmitted from a PS3 to the PSN if you're on a CFW that someone has really fucked up.Emergent said:This is just more spin. Trying to counter the devastating implications of this: http://lo-ping.org/2011/04/26/psn-hacker-chat-logs/ (where the "users" seem to be indicating that the info was not, in fact, encrypted).
Why counter it? Because they're potentially liable for billions.
ArsA document written by the hackers has clarified what they did and what privacy and security risks they believe the PlayStation 3 poses. The PS3's connection to PSN is protected by SSL. As is common to SSL implementations, the identity of the remote server is verified using a list of certificates stored on each PS3. The credit card and other information is sent over this SSL connection. So far so good; this is all safe, and your web browser depends on the same mechanisms for online purchases.
The concern raised by the hackers is that custom firmwares could subvert this system. A custom firmware can include custom certificates in its trusted list. It can also use custom DNS servers. This raises the prospect of a malicious entity operating his own proxies to snaffle sensitive data. He would distribute a custom firmware that had a certificate corresponding to his proxy, and that used a DNS server that directed PSN connections to the proxy. His proxy would decrypt the data sent to it, and then re-encrypt it and forward it to the real PSN servers.
Such a scheme would be transparent to PSN users (except for any potential performance reduction caused by the proxying), and would give the attacker access to all the information that the PS3 sends to Sony. This information is shown to be extensive, but apart from the credit card data, probably not too sensitive or unreasonable.
As flaws go, the risks here are not substantial. There is no generalized ability for hackers to grab credit cards from PSN users; only those using specially devised custom firmwares would be at risk. Essentially the same risk could be faced by anyone downloading a pirated version of Windows: extra certificates could be added to those normally trusted, along with suitable DNS entries, to allow interception of any traffic destined for, say, amazon.com. In practice, the risk of either of these is slight, and in any case, trivially avoided: don't use custom firmware.